Cookie Banner Rules for UK Small Businesses in 2026

If you run a UK business website, you may have seen the headlines: from February 2026, analytics cookies no longer need consent. It's half true, and the half that isn't is the half that matters. The rules genuinely did change — the first substantial change to Britain's cookie law in years — but the exemption is much narrower than the summaries suggest, and the maximum penalty went up sharply at the same time.

Here's what changed, what didn't, and what a small business should actually do about it. This is a plain-English summary rather than legal advice, and the specifics of your site matter.

What actually changed on 5 February 2026

Cookies in the UK are governed by PECR — the Privacy and Electronic Communications Regulations — sitting alongside UK GDPR. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, amended PECR, and those amendments came into force on 5 February 2026.

Two things changed. First, a short list of low-risk purposes moved outside the consent requirement altogether. Second, the maximum fine under PECR rose from £500,000 to £17.5 million or 4% of worldwide annual turnover, whichever is higher — bringing it in line with UK GDPR.

What did not change is the standard of consent itself. If your cookie banner was non-compliant in January, it is still non-compliant now, against a much larger ceiling.

The five things you can store without consent

PECR now lists five purposes for which you can store or read information on a visitor's device without asking first:

• —Carrying out the transmission of a communication over a network
• —Providing a service the person has actually asked for, where the storage is strictly necessary to deliver it
• —Collecting statistics about how your site is used, in order to improve it
• —Adapting the appearance or functionality of your site to someone's preference, such as accessibility or display settings
• —Working out someone's location in order to provide emergency assistance

Why the new exemptions are narrower than they sound

The first two of those existed already. The last three are new, and they arrive with conditions that do most of the work.

The purpose has to be the sole purpose. You still have to tell people clearly what you are storing and why, which means you still need a cookie notice. You have to give a simple, free way to object, and honour it. And information gathered under the statistics exemption cannot be handed to anyone else, except where that person is helping you improve your own site.

So a cookie doing two jobs — measuring traffic and building an advertising audience — is not exempt. Purpose limitation is the whole game here, and it is where most sites will fall outside the exemption without realising.

"Strictly necessary" is also narrower than people hope. It covers things like keeping a basket populated, keeping someone logged in, balancing server load and securing the service requested. It does not stretch to anything you consider necessary for your marketing.

This probably doesn't free you from your Google Analytics banner

For most small business websites, the only non-essential cookies come from Google Analytics. The tempting reading is: analytics is exempt now, so the banner can go. Careful practitioners are not reading it that way, for two reasons.

Google Analytics sends data to Google, which uses it for its own purposes as well as yours — which is difficult to reconcile with a condition that the information is not shared with anyone else except to help improve your site. And GA4's advertising features, including links to Google Ads and personalised advertising signals, put that data squarely into the advertising bucket, which sits outside the exemption entirely.

There is genuine disagreement at the edges. Some practitioners argue that a tightly configured, advertising-features-off setup could qualify, and the regulator has not blessed or condemned any specific product. Our position is the conservative one: if your measurement feeds Google Ads, Meta or any remarketing audience in any way, keep asking for consent.

If you want measurement without a consent prompt, the cleaner route is analytics that stores nothing on the visitor's device at all — several privacy-focused tools work this way, which puts them outside these rules rather than relying on an exemption.

What a compliant banner still has to do

The consent standard is unchanged, and it is stricter than most small business banners manage. If you use any non-essential cookies, your banner needs to:

• —Offer accept and reject with equal prominence on the first screen — a bold Accept button beside a small "manage preferences" link does not meet the standard
• —Set no non-essential cookies until someone has agreed — telling people is not the same as asking them, and many banners load scripts on arrival regardless
• —Avoid pre-ticked boxes and treat scrolling or continued browsing as no answer at all
• —Make withdrawing consent as easy as giving it, with a visible way back to the settings
• —Link to a cookie notice that lists what you set, what each one does, how long it lasts and which third parties receive the data

The fines went up. Be realistic about what that means for you.

A £17.5 million ceiling makes for an alarming headline, and it is worth being straight about who it is aimed at. The regulator's cookie work has visibly focused on the largest sites in the country: it wrote to the operators of the UK's top 100 websites in November 2023, and in January 2025 announced it would bring the top 1,000 into compliance. A five-page site for a plumber in Bromley is not next in that queue.

The realistic risk for a small business is smaller and more mundane: a complaint from a visitor who noticed, an awkward question in a procurement or client due-diligence questionnaire, or a tender form asking how you handle personal data. Fix it because it is cheap to fix and quietly costs you credibility when it is wrong — not because you are expecting a seven-figure penalty. Anyone selling you compliance software with fine figures in the subject line is selling fear.

A sensible check, in about half an hour

Start by finding out what your site actually sets. Open it in Chrome, press F12, and look under the Application tab for cookies and local storage — or run one of the free cookie scanners. Most owners are surprised: an old chat widget, an embedded map or a marketing tag from a campaign three years ago is a common find.

Then sort what you find into three buckets: strictly necessary, statistics only, and marketing. Be honest about the middle one, particularly if your analytics is connected to an ad account.

If everything is strictly necessary — a brochure site with a contact form, no analytics and no pixels — you may not need a banner at all. Plenty of small sites carry one out of habit, and a consent prompt nobody needs is just friction between a visitor and your enquiry form.

If anything lands in the marketing bucket, you need a consent tool that genuinely blocks those scripts until someone agrees, rather than a banner that only announces them. Then write the cookie notice to match what the site really does, and revisit it whenever you add something — embedding a YouTube video or a new booking widget can change the answer.

If you are unsure after that, the ICO's own guidance on cookies and similar technologies is free, readable and the authoritative source. For anything genuinely borderline, take proper advice.

How we handle this on the sites we build

Every site we build ships with a consent setup as standard: non-essential scripts held back until someone agrees, a reject option weighted the same as accept, and a cookie notice that matches what the site actually sets rather than a template listing cookies you don't use.

If you are not sure what your current site is doing — or you have inherited one and nobody can tell you what the banner is connected to — we're happy to take a look and tell you plainly whether it needs changing. Often the answer is a small fix rather than a project, and we'd rather say so.